FreeCalypso > hg > freecalypso-reveng
annotate pirelli/calypso @ 162:8d30e1722e0f
locked C139 bootloader reverse-engineered
author | Michael Spacefalcon <msokolov@ivan.Harhan.ORG> |
---|---|
date | Thu, 15 May 2014 20:55:39 +0000 |
parents | 8e4dac492552 |
children |
rev | line source |
---|---|
54
8e4dac492552
another Pirelli PCB tracing session, focusing on the display subsystem
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
10
diff
changeset
|
1 BGA orientation: A1 is the LR corner in steve-m's L1 picture. Row A is on the |
8e4dac492552
another Pirelli PCB tracing session, focusing on the display subsystem
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
10
diff
changeset
|
2 bottom; row P is on the top; column 1 is on the right; column 14 is on the left. |
8e4dac492552
another Pirelli PCB tracing session, focusing on the display subsystem
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
10
diff
changeset
|
3 |
10
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
4 Calypso pin I thought was nIBOOT (N1), but actually seems to be A13 (RFEN): |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
5 the trace from the ball goes straight down to a via, L1 image coords |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
6 (3676,1174). On L2 trace goes to another via at (3234,1074). On L5 it goes |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
7 to yet another via at (2950,535). On L4 it goes to (1941,457). On L2 it goes |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
8 to a surface via at (1957,484). Back on L1 it goes to Rita pin 2 (XEN). |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
9 This arrangement matches what the Rita spec describes as the "external VCTCXO" |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
10 configuration. In contrast, the Leonardo schematics depict the "internal |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
11 VCTCXO" configuration. |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
12 |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
13 Double-checking: in the "external VCTCXO" configuration Rita pin 1 (XSEL) is |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
14 supposed to be grounded. On L1 the pad appears to go nowhere (isolated). |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
15 The central coordinates of the pad on L1 are (1956,638). On L2 there is |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
16 solid copper fill in that area. Perhaps there is an invisible micro-via? |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
17 |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
18 The real nIBOOT pin (N1): stays on L1, a trace takes it to one pad of a |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
19 2-pad SMT component, the other pad's connection is unclear (appears isolated, |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
20 must be an invisible micro-via). Must be a pull-up/down resistor, hopefully |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
21 pull-down. |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
22 |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
23 nCS0 (C2): L1 trace to (4262,1016). On L2 it goes to two via points: |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
24 (4852,1016), an obvious larger via, and (4802,1000), a spot where a micro-via |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
25 back to L1 could hide. The micro-via back to L1 appears to be there indeed, |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
26 feeding an unmasked test point on the surface. Back to the main trace at |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
27 (4852,1016): there's something on L4 (might be a trace to another nearby via), |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
28 but maybe it's nothing, just a poor picture. Most likely nothing there, as |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
29 the same arrangement appears on L5 and L6, but clearly with no connection |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
30 between the two nearby vias. L7 is probably where the interesting connection |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
31 is, but the trace appears to have been scraped off in that spot in steve-m's |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
32 layer-grinding process. |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
33 |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
34 Taking a different approach: let's start with the RAM/flash MCP on L8. Flash |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
35 CE1# goes to (4911,987); flash CE2# goes to (4954,660) and to an L8 test pad; |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
36 OE# goes to (4885,982); RAM CE1# goes to (4860,978). Of the two L2-L7 vias, |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
37 the upper one appears to be RAM, and the lower one appears to be flash. |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
38 |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
39 Mistake found: I had earlier messed up trying to trace nCS0 on L2. Now it's |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
40 all clear: nCS0 goes to flash CE1#. |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
41 |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
42 Now let's trace the RAM CS. From the upper L2-L7 via it goes on L2 to |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
43 (4800,1002) - already known to be a test point - and to (4212,978). |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
44 On L1 it goes to Calypso pin C3 - nCS1, just like on Leonardo. |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
45 |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
46 Now let's trace flash CE2#. L7-L8 via at (4954,660); L2-L7 via at (4965,927); |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
47 on L2 it goes to (4210,930), on L1 it goes to Calypso ball D3. |
b0f7481efc8b
Pirelli PCB rev eng: finally have something worthy to report:
Michael Spacefalcon <msokolov@ivan.Harhan.ORG>
parents:
diff
changeset
|
48 That's nCS3. |